Predictable Random Number Generation in Bytes::Random::Secure for Perl
CVE-2026-11625
Currently unrated
What is CVE-2026-11625?
The Bytes::Random::Secure library for Perl exhibits a vulnerability where the internal state of the Pseudo-Random Number Generator (PRNG) is shared across forked processes when an object is initialized prior to forking, or when utilizing the functional interface. This results in identical random streams being generated across separate processes, leading to predictable outcomes for cryptographic operations. Consequently, secrets produced within multiprocess applications may be compromised, establishing a critical need for updates to the affected library versions.
Affected Version(s)
Bytes::Random::Secure 0 <= 0.29